# DF-4790 — latent unvalidated event-count walks in dead debug printers; sentinel-plus-one convention in mpr_describe_table

## What

`sys/dev/raid/mpr/mpr_table.c` contains two latent defects in code that is **currently
dead** (no callers anywhere in `sys/` — verified with tree-wide grep; only
`mpr_print_scsiio_cmd`/`mpr_print_sgl` and `mpr_describe_devinfo`/`mpr_describe_table`
are live):

1. **`mpr_print_evt_sas` topology walk (`mpr_table.c:412-425`).**
   ```c
   for (i = 0; i < data->NumEntries; i++) {
           phy = &data->PHY[i];
   ```
   `NumEntries` is a firmware-supplied byte inside the event reply and is never checked
   against `EventDataLength`. The MPI2 event structure carries `PHY[]` for the entries
   actually delivered; a short frame with a large `NumEntries` walks past the event
   buffer (OOB heap read printed to console). This is the *same defect class* pass 1
   filed against the **live** consumers (DF-1474 on `mpr_sas_lsi.c`, DF-3919 on
   `mpr_mapping.c`, mps twin DF-4560) — but in `mpr_table.c` the function has no
   callers, so it is latent. If anyone ever wires this printer up (its mps counterpart
   was historically called from the event handler), the unbounded walk comes back.
   Recommended resolution: bound the loop by `EventDataLength * 4` (fix.diff) or delete
   the dead printer.

2. **`mpr_describe_table` sentinel-plus-one (`mpr_table.c:63-73`).**
   ```c
   for (i = 0; table[i].string != NULL; i++) { ... }
   return(table[i+1].string);
   ```
   The fallback intentionally indexes one entry **past** the `{NULL, 0}` sentinel. All
   13 tables in this file happen to carry an extra `{"Unknown …", 0}` entry after the
   sentinel (`mpr_table.c:107-108, 117-118, 131-132, 139-140, 152-153, 162-163,
   169-170, 178-179, 194-195, 204-205, 226-227, 242-243, 255-256`), so today it is
   in-bounds — but any future table that ends at the sentinel turns the "unknown code"
   lookup into an OOB pointer read + `%s` deref. Fragile-by-convention, worth a
   defensive bound or a literal fallback string.

Also noted, benign: `mpr_table.c:457` — the `MPI2_EVENT_SAS_DEVICE_STATUS_CHANGE` case
falls through to `default:` (missing `break;`); `default: break;` makes it harmless.

## Impact

None today (dead code / in-bounds-by-convention). Filed as Info hardening so the
patterns don't get resurrected as-is.

## Verdict

`untested` — latent code-path finding; nothing to execute.